Forum Discussion
Analytic rule querying
Hello,
I'm working on alerting in Azure sentinel, my domain controller is connected with Azure, for example when someone trying to login to my domain, it will be logged.
I already know u can make an analytic rule with a query and run it every x minutes and u can attach a playbook to it, for example, to send mail of the incident.
But here is my question, how do u do real-time alerting?
for example in the analytics tab, u can only trigger to query every 5 minutes to look if your query has results or not, based on the results u can send an alert. U can't go below 5 minutes, this means if someone got access to the account, it would take at least 5 minutes to send an alert.
Does anyone know know how to query it for example every 1-2 minutes?
- Rod_Trent
Microsoft
FeintBE Are you familiar with our Livestream component in the Hunting blade. When you right-click on a query here, you can add it to the Livestream tab where you can start and stop the stream. What this does is set the query to run every 1 minute and you'll be alerted through Azure notifications as long as the livestream is active. The display for the active Livestream will also increment whenever the result is reached. This is a great way to monitor a potentially active threat.
